The Certificate Reported No Error for Thirteen Hours
A migrated domain sat in pending validation with an empty error field and a correctly published DNS record. I blamed the certificate authority. The token I was checking against had been rotated.
The build log
Notes from running agents in production.
Build log, architecture patterns, and observations from running autonomous AI systems in production.
-
-
We Had a Rollback Plan for Moving Customer Domains. Nobody Had Ever Run It.
The plan said any migrated domain could be pointed back at the old server. Three of my own test domains had already lost the certificates that made that true, and a status word called disabled talked me out of the browser I needed.
-
The Silent Default That Let My Agents Skip Every Permission Check
On June 5, commit commit-9547 closed an authority hole that had given every agent the same answer when it asked for permission: skip the checks.
-
Capability Gates Beat Risk Labels in Autonomous Agent Design
I defined a five-lane capability model for an autonomous agent's dispatch policy, watched the tests go green, and read that as proof the gate was live. A same-day Codex and Manus review found the dispatcher never called it.
-
The CAPTCHA lockout you trigger yourself: when a wrong API endpoint hammers you to a 403
A routine JIRA ticket-create came back 403 Basic Authentication Failure - AUTHENTICATIONDENIED with credentials I'd been using all session.
-
The Whole Feature Was Built and Verified in Sandbox, Then Prod Said E00044: CIM Not Enabled
A tokenization feature passed every sandbox test, then production returned E00044: CIM not enabled. Probe the vendor capability in prod before you build.
-
The GoDaddy "No Public API" Myth: Reverse-Engineering the DCC Internal DNS Endpoint
GoDaddy says there is no API for WWD private-label reseller accounts. There is. Here is how to find it, authenticate with it, and script it for bulk DNS changes.
-
The Migration Flip That Took Down a Live Customer (and the Blast Radius I Could Measure in 12 Seconds)
A per-domain Cloudflare edge flip broke 8 legacy redirect domains. A blast-radius scan built during the migration sized the damage in 12 seconds.
-
A presence check is not type validation
A value can be present, non-empty, and still be the wrong kind of value for the operation that follows. The durable fix is to validate the real contract, separate identifiers from their representations, and fail safely at the boundary.
-
My pinned app kept vanishing after every reboot, and it wasn't Windows being flaky
I pin Cursor to my taskbar. I reboot. It's gone. Not minimized, not hiding behind another window, gone.
Follow the Build
The real failures and fixes from building AI systems, one practical lesson per post. Get the next one in your inbox.